CVE-2018-7063 : Security Advisory and Response

Aruba ClearPass Policy Manager by Hewlett Packard Enterprise has a vulnerability that allows disabled API administrators to perform unauthorized read/write operations, potentially leading to a complete compromise of the system.

Understanding CVE-2018-7063

This CVE involves a security issue in Aruba ClearPass Policy Manager that enables disabled API administrators to carry out read/write tasks, posing a risk of unauthorized access and system compromise.

What is CVE-2018-7063?

Aruba ClearPass Policy Manager allows disabled API administrators to conduct read/write operations on specific parts of the XML API, potentially leading to unauthorized access and complete compromise if exploited by attackers.

The Impact of CVE-2018-7063

The vulnerability in Aruba ClearPass Policy Manager could result in unauthorized access to the API and complete compromise of the ClearPass instance if attackers exploit the disabled API administrator accounts.

Technical Details of CVE-2018-7063

Aruba ClearPass Policy Manager vulnerability details and affected systems.

Vulnerability Description

Even when disabled, API administrators in Aruba ClearPass can still carry out read/write tasks, potentially leading to unauthorized access and compromise of the system.

Affected Systems and Versions

Product: Aruba ClearPass Policy Manager
Vendor: Hewlett Packard Enterprise
Versions Affected: ClearPass 6.7.x prior to 6.7.6, ClearPass 6.6.10 and earlier without hotfix applied

Exploitation Mechanism

The vulnerability allows disabled API administrators to perform unauthorized read/write operations on certain aspects of the XML API, enabling potential unauthorized access and system compromise.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2018-7063 vulnerability.

Immediate Steps to Take

Apply the necessary hotfixes or updates to affected versions of Aruba ClearPass Policy Manager.
Monitor API administrator activities for any unauthorized access.

Long-Term Security Practices

Regularly review and update access control policies for API administrators.
Conduct security audits to identify and address any potential vulnerabilities.

Patching and Updates

Ensure all systems running Aruba ClearPass Policy Manager are updated with the latest patches and security fixes to prevent exploitation of this vulnerability.